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Abstract 



o 

(N 

^-^' We present several new examples of speed-ups obtainable by quantum algorithms in the 

, ^ , context of property testing. 

First, motivated by sampling algorithms, we consider probability distributions given in the 

p^ ' form of an oracle / : [n] — >■ [m]. Here the probability Vfij) of an outcome j G [m] is the fraction 

of its domain that / maps to j. We give quantum algorithms for testing whether two such 

distributions are identical or e-far in Li-norm. Recently, Bravyi, Hassidim, and Harrow [llj 

(~| ■ showed that if Vf and Vg are both unknown (i.e., given by oracles / and g), then this testing 

Mh| can be done in roughly y/m quantum queries to the functions. We consider the case where the 

^ second distribution is known, and show that testing can be done with roughly m^'^ quantum 

jrt ' queries, which we prove to be essentially optimal. In contrast, it is known that classical testing 

^ I algorithms need about m'^'^ queries in the unknown-unknown case and about y/m queries in 

the known-unknown case. Based on this result, we also reduce the query complexity of graph 

isomorphism testers with quantum oracle access. 

S^ I While those examples provide polynomial quantum speed-ups, our third example gives a 

j«^ ' much larger improvement (constant quantum queries vs polynomial classical queries) for the 

CN| , problem of testing periodicity, based on Shor's algorithm and a modification of a classical lower 

1^ I bound by Lachish and Newman |28) . This provides an alternative to a recent constant- vs- 

polynomial speed-up due to Aaronson [1]. 
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1 Introduction 

Since the early 1990s, a number of quantum algorithms have been discovered that have much better 
query complexity than their best classical counterparts [iTl [32l [24l HI HSl [5] . Around the same time, 
the area of property testing gained prominence O [22| [20| [30] . Here the aim is to design algorithms 
that can efficiently test whether a given very large piece of data satisfies some specific property, or 
is "far" from having that property. 

Buhrman et al. [13] combined these two strands, exhibiting various testing problems where 
quantum testers are much more efficient than classical testers. There has been some recent subse- 
quent work on quantum property testing, such as the work of Friedl et al. |21] on testing hidden 
group properties, Atici and Servedio [6J on testing juntas, Inui and Le Gall [26] on testing group 
solvability, Childs and Liu [15] on testing bipartiteness and expansion, Aaronson [1] on "Fourier 
checking", and Bravyi, Hassidim, and Harrow [11] on testing distributions. We will say more about 
the latter papers below. 

In this paper we continue this line of research, coming up with a number of new examples where 
quantum testers substantially improve upon their classical counterparts. It should be noted that 
we do not invent new quantum algorithms here — rather, we use known quantum algorithms as 
subroutines in otherwise classical testing algorithms. 

1.1 Distribution Testing 

How many samples are needed to determine whether two distributions are identical or have Li- 
distance more than e? This is a fundamental problem in statistical hypothesis testing and also 
arises in other subjects like property testing and machine learning. 

We use the notation [n] = {1, 2,3, . . . ,n}. For a function / : [n] — ;■ [m], we denote by Vf the 
distribution over [m] in which the weight 'P/(i) of every j £ [m] is proportional to the number of 
elements i G [n] that are mapped to j. We use this form of representation for distributions in order 
to allow queries. Namely, we assume that the function / : [n] — t- [m] is accessible by an oracle of 
the form \x)\b) i— )• |x)|6© fix)), where a; is a logn-bit string, b and /(x) are logTTi-bit strings and 
© is bitwise addition modulo two. Note that a classical random sample according to a distribution 
Vf can be simply obtained by picking i £ [n] uniformly at random and evaluating f{i). In fact, a 
classical algorithm cannot make a better use of the oracle, since the actual labels of the domain [n] 
are irrelevant. See Section [6] for more on the relation between sampling a distribution and querying 
a function. 

We say that the distribution Vf is known (or explicit) if the function / is given explicitly, and 
hence all probabilities 'P/(j) can be computed. Vj is unknown (or black-box) if we only have oracle 
access to the function /, and no additional information about / is given. Two distributions Vf,Vg 
defined by functions f,g : [n] — )• [m] are e-far if the Li-distance between them is at least e, i.e., 
||7^/ — VgWi = jyJLi I'PfU) ~ 'PgU)\ ^ ^- Note that f = g implies Vj = Vg but not vice versa (for 
instance, permuting / leaves Vf invariant). Two problems of testing distributions can be formally 
stated as follows: 

• unknown-unknown case. Given n,m,e and oracle access to f,g : [n] — )• [m], how many 



queries to / and g are required in order to determine whether the distributions Vj and Vg 
are identical or e-far? 

• known-unknown case. Given n, m, e, oracle access to / : [n] — )■ [m] and a known distribu- 
tion Vg (defined by an explicitly given function g : [n] — )• [m]), how many queries to / are 
required to determine whether Vj and Vg are identical or e-far? 

If only classical queries are allowed (where querying the distribution means asking for a ran- 
dom sample), the answers to these problems are well known. For the unknown- unknown case Batu, 
Fortnow, Rubinfeld, Smith, and White [8] proved an upper bound of 0(771^'^) on the query com- 
plexity, and Valiant [33j proved a matching (up to polylogarithmic factors) lower bound. For the 
known-unknown case, Goldreich and Ron ^23j showed a lower bound of il.{^/Tn) queries and Batu, 
Fischer, Fortnow, Rubinfeld, Smith, and White [^ proved a nearly tight upper bound of 0{y/m) 
queries 111 

1.1.1 Testing with Quantum Queries 

Allowing quantum queries for accessing distributions, Bravyi, Hassidim, and Harrow [TT] recently 
showed that the Li-distance between two unknown distributions can actually be estimated up to 
small error with only 0{y/m) queries. Their result implies an 0{^/rn) upper bound on the quantum 
query complexity for the unknown-unknown testing problem defined above. In this paper we 
consider the known-unknown case, and prove nearly tight bounds on its quantum query complexity. 

Theorem 1.1 Given n,m,€, oracle access to / : [n] — )■ [m] and a known distribution Vg (defined 
by an explicitly given function g : [n] — )• [m]), the quantum query complexity of determining whether 
Vf and Vg are identical or e-far is 0( "'^''°'^'j^°^'°^"" ) = m^/^ . poly(i,logm). 

We prove Theorem II. II in two parts. First, in Section [3.11 we prove that with 0( ^ 'x ) quantum 
queries it is possible to test whether a black-box distribution Vf (defined by some / : [n] — t- [rn\) 
is e-close to uniform. We actually prove that this can be even done tolerantly in a sense, meaning 
that a distribution that is close to uniform in the L^o norm is accepted with high probability (see 
Theorem 13.11 for the formal statement). Then, in Section F3.2| we use the bucketing technique (see 
Section 12. 1|) to reduce the task of testing closeness to a known distribution to testing uniformity. 

We stress that the main difference between the classical algorithm of [7] and ours is that in 
[7] they check the "uniformity" of the unknown distribution in every bucket by approximating the 
corresponding L2 norms of the conditional distributions. It is not clear if one can gain anything 
(in the quantum case) using the same strategy, since we are not aware of any quantum procedure 
that can approximate the L2 norm of a distribution with less than y/m queries. Hence, we reduce 
the main problem directly to the problem of testing uniformity. For this reduction to work, the 
uniformity tester has to be tolerant in the sense mentioned above (see Section [3.21 for details). 



^These classical lower bounds are stated in terms of number of samples rather than number of queries, but it is 
not hard to see that they hold in both models. In fact, the y/m classical query lower bound for the known-unknown 
case follows by the same argument as the quantum lower bound in Section (4] 



A different quantum uniformity tester was recently discovered (independently) in [TT]. We note 
that our version has the advantages of being tolerant, which is crucial for the application above, 
and it has only polynomial dependence on e (instead of exponential), which is essentially optimal. 

1.1.2 Quantum Lower Bounds 

Known quantum query lower bounds for the collision problem [21 [Sj [27] imply that in both known- 
unknown and unknown-unknown cases roughly m^'^ quantum queries are required. In fact, the 
lower bound applies even for testing uniformity (see proof in Section [1]) : 

Theorem 1.2 Given n,m,€ and oracle access to / : [n] — )• [m], the quantum query complexity of 
determining whether Vj is uniform or e-far from uniform is Q{m^'^). 

The main remaining open problem is to tighten the bounds on the quantum query complexity 
for the unknown-unknown case. It would be very interesting if this case could also be tested 
using roughly m^'^ quantum queries. In Section [5] we show that the easiest way to do this (just 
reconstructing both unknown distributions up to small error) will not work — it requires Vt{m/ log m) 
quantum queries. 

1.2 Graph Isomorphism Testing 

Fischer and Matsliah [19] studied the problem of testing graph isomorphism in the dense-graph 
model, where the graphs are represented by their adjacency matrices, and querying the graph 
corresponds to reading a single entry from its adjacency matrix. The goal in isomorphism testing 
is to determine, with high probability, whether two graphs G and H are isomorphic or e-far from 
being isomorphic, making as few queries as possible. (The graphs are e-far from being isomorphic 
if at least an e- fraction of the entries in their adjacency matrices need to be modified in order to 
make them isomorphic.) 

In [19] two models were considered: 



• unknown-unkno'wn case. Both G and H are unknown, and they can only be accessed by 
querying their adjacency matrices. 

• known- unkno'wn case. The graph H is known (given in advance to the tester), and the 
graph G is unknown (can only be accessed by querying its adjacency matrix). 

As usual, in both models the query complexity is the worst-case number of queries needed to 
test whether the graphs are isomorphic. [19] give nearly tight bounds of 0(-\/|V^) on the (classical) 
query complexity in the known-unknown model. For the unknown-unknown model they prove an 
upper bound of 0(|F|^''^) and a lower bound of f^(|l^|) on the query complexity. 

Allowing quantum queries, we can use our aforementioned results to prove the following query- 
complexity bounds for testing graph isomorphism (see proof in Section [7]) : 



^A quantum query to the adjacency matrix of a graph G can be of the form \i,j)\h) i— >■ \i,j)\h ® G{i,j)), where 
G{i,j) is the {i,j)-th entry of the adjacency matrix of G and ® is addition modulo two. 



Theorem 1.3 The quantum query complexity of testing graph isomorphism in the known-unknown 
case is @{\V\^'^), and in the unknown-unknown case it is between Q{\V\^'^) and @{\V\''''^). 

1.3 Periodicity Testing 

The quantum testers mentioned above obtain polynomial speed-ups over their classical counter- 
parts, and that is the best one can hope to obtain for these problems. The paper by Buhrman 
et al. [13], which first studied quantum property testing, actually provides two super-polynomial 
separations between quantum and classical testers: a constant-vs-log n separation based on the 
Bernstein- Vazirani algorithm, and a (roughly) log n-\s-^/n separation based on Simon's algorithm. 
They posed as an open problem whether there exists a constant-vs-n separation. Recently, in an 
attempt to construct oracles to separate BQP from the Polynomial Hierarchy, Aaronson [T] ana- 
lyzed the problem of "Fourier checking" : roughly, the input consists of two m-bit Boolean functions 
/ and g, such that g is either strongly or weakly correlated with the Fourier transform of / (i.e., 
g{x) = sign(/(x)) either for most x or for roughly half of the x). He proved that quantum algo- 
rithms can decide this with 0(1) queries while classical algorithms need Q.{2^''^) queries. Viewed 
as a testing problem on an input of length n = 2 • 2"^ bits, this is the first constant-vs-polynomial 
separation between quantum and classical testers. 

In Section [5] we obtain another separation that is (roughly) constant-vs-n^''^. Our testing 
problem is reverse-engineered from the periodicity problem solved by Shor's famous factoring al- 
gorithm [31j. Suppose we are given a function / : [n] — )• [rn\, which we can query in the usual way. 
We call / 1-1-p-periodic if the function is injective on [p] and repeats afterwards. Equivalently: 

/(^) = /(j) iff i = i mod p. 

Note that we need m > p to make this possible. In fact, for simplicity we will assume m > n. 
Let Vp be the set of functions / : [n] — )• [m] that are 1-1-p-periodic, and Vg^r = ^p=q'Pp- The 1-1- 
PERIODICITY TESTING problem, with parameters q < r and small fixed constant e, is as follows: 

given an / which is either in Vq^r or e-far from Vq^r, find out which is the case. 

Note that for a given p it is easy to test whether / is p-periodic or e-far from it: choose an i £ [p] 
uniformly at random, and test whether /(i) = f{i + kp) for a random positive integer k. If / is 
p-periodic then these values will be the same, but if / is e-far from p-periodic then we will detect 
this with constant probability. However, r — q-\- 1 different values of p are possible in Vq^r, and we 
will see below that we cannot efficiently test all of them — at least not in the classical case. In the 
quantum case, however, we can. 

Theorem 1.4 There is a quantum tester for Vr^ur^ 12 using 0(1) queries (and polylog{n) time), 
while for every even integer r G [2, n/2), every classical tester for V,. 12, r needs to make Q.{^J r / \ogr\ogn) 
queries. In particular, testing Vr:p^ur^ 12 requires Q{n^''^/ log n) classical queries. 

The quantum upper bound is obtained by a small modification of Shor's algorithm: use Shor 
to find the period (if there is one) and then test this purported period with another 0(1) queries. 

6 



The classical lower is based on ideas from Lachish and Newman [28], who proved classical testing 
lower bounds for more general periodicity-testing problems. However, while we follow their general 
outline, we need to modify their proof since it specifically applies to functions with range {0,1}, 
which is different from our 1-1 case. The requirement of being 1-1 within each period is crucial 
for the upper bound — quantum algorithms need about \/n queries to find the period of functions 
with range {0, 1}. While our separation is slightly weaker than Aaronson's separation for Fourier 
checking (our classical lower bound is n^'^/logn instead n^'^), the problem of periodicity testing 
is arguably more natural, and it may have more applications than Fourier checking. 

2 Preliminaries 

For any distribution V on \m\ we denote by 'P(j) the probability mass of j S \m\ and for any 
M C [m] we denote by V{M) the sum YljeAd'^U)- ^°^ ^ function / : [n] — ;• [m], we denote by Vf 
the distribution over [m] in which the weight Vf{j) of every j € [m] is proportional to the number 
of elements i G [n] that are mapped to j. Formally, for all j G [m] we define Vf{j) = Pri.^;7[/(i) = 
j] = ' „ ; where U is the uniform distribution on [n], that is U{i) = 1/n for all z G [n]. Whenever 
the domain is clear from context (and may be something other than [n]), we also use U to denote 
the uniform distribution on that domain. 

Let ||-||i and ||-||oo stand for Li-norm and Loo-norm respectively. Two distributions Vf^Vg 
defined by functions /, g : [n] — t- [m] are e-/ar if the Li-distance between them is at least e. Namely, 
Vf is e-far from Vg if \\Vf -Vg\\i = ZT=i 1^/0') " ^0')! > ^■ 

2.1 Bucketing 

Bucketing is a general tool, introduced in [HI [7], that decomposes any explicitly given distribution 
into a collection of distributions that are almost uniform. In this section we recall the bucketing 
technique and the lemmas (from [HI [7]) that we will need for our proofs. 

Definition 2.1 Given a distribution V over [m], and M C [m] such thatV{M) > 0, the restriction 
V\M ^-5 0, distribution over M with "PiAf (0 = V{i)/V{M). 

Given a partition M = {Mq, Mi, . . . , M^} of [m], we denote by Vij^\ the distribution over 
{0} U [k] in which P(x)(i) =V{Mi). 



Given an explicit distribution V over [tti], Bucket(V,[m],e) is a procedure that generates a 

21ogm 
log(l+e) ■ 



partition {Mq, Mi, . . . , M^} of the domain [m], where k = -, — rfr^- This partition satisfies the 



following conditions: 

. Mo = {j G [m] I Vij) < ;^}; 

. for all ^ G [k], M = {j G [m] \ ^j^ < V{j) < ^}. 

Lemma 2.2 ([T]) Let V be a distribution over [m] and let {Mg, Mi, . . . , M^} -^ Bucket{V, [m], e). 
Then (i) V{Mo) < 1/logm; (ii) for all i G [k], \\V\m, - C/|mJ|i < e- 
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Lemma 2.3 ([7]) Let V,V' he two distributions over [m] and let M. = {Mq,Mi, . . . ,Mk} he a 
partition of [m\. If ||'P|a/- — "Pu/ Hi — ^i ■^^'^ every i G [A;] and if in addition ||'P(x) — 'P(_a4\IIi ^ ^2; 
then ||7^-7^'||i < ei + e2. 

Corollary 2.4 Let V, V' be two distributions over [m] and let M = {Mq, Mi, . . . , M^} be a par- 
tition of [m]. If \\V\Mi — 'P'lM-W^ — ^1 f'^^ every i £ [k] such that V{Mi) > e^/k, and if in addition 
\\'^{M) - 'P[m)\\^ ^ ^2, then \\V - rill < 2(ei + 62 + £3)- 

2.2 Quantum Queries and Approximate Counting 

Since we only use specific quantum procedures as a black-box in otherwise classical algorithms, 
we will not explain the model of quantum query algorithms in much detail (see |29t [Hj for that). 
Suffice it to say that the function / is assumed to be accessible by the oracle unitary transformation 
Of, which acts on a (logn + log r?2)-qubit space by sending the basis vector |a;)|6) to |x)|6© f{x)) 
where © is bitwise addition modulo two. 

For any set S C [m], let U^ denote the unitary transformation which maps |x)|5) to |x)|6© 1) if 
f{x) G S, and to |x)|5©0) otherwise. This unitary transformation can be easily implemented using 
logm ancilla bits and two queries to O/o If fs '■ ["-] — ^ {0, 1} is defined as fs{x) = 1 if and only 
if f{x) G S, then the unitary transformation U? acts as an oracle to the function fg. Brassard, 
H0yer, Mosca, and Tapp |10l Theorem 13] gave an algorithm to approximately count the size of 
certain sets. 

Theorem 2.5 ( |10] ) For every positive integer q and i > 1, and given quantum oracle access to 
a Boolean function h : [n] — )• {0, 1}, there is an algorithm that makes q queries to h and outputs 

an estimate t' to t = |/i^^(l)| such that \t' — t\ < 2tt£— \- 7r^£^-^ with probability at least 

1-1/2(^-1). 

The following lemma allows us to estimate the size of the pre-image of a set S C [m] under /. 
It follows easily from Theorem 12.51 

Lemma 2.6 For every 5 G [0, 1], for every oracle Of for the function / : [n] — )■ [m], and for every 
set S C [m], there is a quantum algorithm QEstimate(/, S, 5) that makes 0{m^'^/5) queries to f 
and, with probability at least 5/6, outputs an estimate p' to p = 'Pf{S) = |/^^(S')|/n such that 

Proof. The algorithm is basically required to estimate |/5^(1)|. Using two queries to the 
oracle Of we can construct a unitary U^ that acts like an oracle for the Boolean function fg. 
Estimate t = \fg (1)| using the algorithm in Theorem 12.51 with q = cm^'^/6 queries. Choosing 
c a sufficiently large constant, with probability at least 5/6, the estimate t' satisfies \t — t'\ < 

"^ ^y3 1 2^. Setting p' = t' /n and bounding (n — t) with n we get that with probability at 

lea"t5/6, |7-p'| = M<iy| + 



1/3 ^ ^2/3 • 



^We need two queries to / instead of one, because the quantum algorithm has to "uncompute" the first query in 
order to clean up its workspace. 



3 Proof of Theorem 11.11 

3.1 Testing Uniformity Tolerantly 

Given e > and oracle access to a function / : [n] — )• [m], our task is to distinguish the case 
WVf — U\\i > € from the case \\Vf — U\\oo < e/4m. Note that this is a stronger condition than the 
one required for the usual testing task, where the goal is to distinguish the case \\Vf — C^||i > e 
from \\Vf - U\\oo = \\Vf - U\\i = 0. 



Theorem 3.1 There is a quantum testing algorithm (Algorithm[l\ below) that given e > and 

1/3 

oracle access to a function / : [n] — )• [m] makes 0(^^^5— ) quantum queries and with probability at 
least 2/3 outputs REJECT if \\Vf - f/||i > e, and ACCEPT if \\Vf - U\\oo < e/4m. 



Algorithm 1 (Tests closeness to the uniform distribution. 



pick a set T C [n] of t = m^'^ indices uniformly at random 

query / on all indices in T; set S ^ {/(«) \ i £ T} 

if f{i) = f{j) for some i,j £ T, i ^ j (or equivalently, \S\ < t) then 

REJECT 
end if 

p' ^ QEstimate(/, S, 5), with 5 = ^ 
if \p' - -\ <325^ then 

ACCEPT 
else 

REJECT 
end if 



We need the following corollary for the actual application of Theorem 13.11 

Corollary 3.2 There is an "amplified" version of Algorithm{l\that given e > and oracle access 

to a function / : [n] — ?• [m] makes 0{— °g "g'" ^ quantum queries and with probability at least 

1 - j^4^ outputs REJECT if WVf - U\\i > e, and ACCEPT if WVf - UWoo < e/4m. 

Proof, [of Theorem 13. Ij Notice that Algorithm [1] makes only 0( ™^ ) queries: t = m^'^ classical 
queries are made initially, and the call to QEstimate requires additional 0{m^''^/6) = 0( '"a ) 
queries. 

Now we show that Algorithm [T] satisfies the correctness conditions in Theorem 13. 1[ Let V C [m] 
denote the multi-set of values {f{x) \ x G T} (unlike S, the multi-set V may contain some element 
of [m] more than once). If WPf — UWoo ^ e/4m then Vf{V) < (1 + ^)t/m, and hence 

/ (i + i)t\* (1 + 1)^2 

p(t]m) = Pr[the elements in V are distinct] > I 1 I > 1 > 1 — o(l). 

\ m J m 

Thus if WPf — UWoo < e/4m then with probability at least 1 — o(l), the tester does not discover 
any collision. If, on the other hand, WPf ~UWi > e and a collision is discovered, then the tester 
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outputs REJECT, as expected. Hence the following lemma suffices for completing the proof of 
Theorem 13. 1[ 



Lemma 3.3 Conditioned on the event that all elements in V are distinct, we have 
• if \\Vf - C/||oo < e/4m then Pr \\VfiV) - t/m\ < g 



if \\Vf - U\\i > e then Pr \VfiV) - t/m\ > §^ 



> 1 



> 1 - o(l); 
-o(l). 



,2/3 



Assuming Lemma 13.31 we first prove Theorem 13.11 Set p = 'Pf{V), and recall that t/m = 1/m 

If \\Vf — U\\oo < e/Am then with probability at least 1 — o(l) the elements in V are distinct and 
also \p — l/m?''^\ < 2/3 ■ III tliis case, by Lemma 12.61 with probability at least 5/6 the estimate 



< 



■ZTJ3 "T 



52 Sy/{l+305)/my3 



< 



+ 



< 



2<5 



and by 



p' computed by QEstimate satisfies |p - /^ | ^ ^^^173 -r ^^^373 ^ ^^173 ^ ^^^273 ^ ;;;:273 . 

the triangle inequality \p' — -\ < 326—. Hence the overall probability that Algorithm [1] outputs 
ACCEPT is at least 5/6 - o(l) > 2/3. 

If WVf — f^lli > e, then either Algorithm [1] discovers a collision and outputs REJECT, or 



otherwise, \p — 1/m 
case distinction. 



2/3 1 



> 



60^ 



with probability 1 — o(l). In the latter case, we make the following 



Case p < lO/m ' : By Lemma F2. 61 with probability at least 5/6 the estimate p' of QEstimate 



satisfies \p—p'\ < — t^ + 



373 



< 



10^ 

YY)2/3 



. Then by the triangle inequality, \p' - 



> 



m,2/-^ 



10(5 

Yy)2/3 



> 



326^. 

m 



Case p > 10 /m?'^: In this case it is sufficient to prove that with probability at least 5/6, 
p' > p/2 (which clearly implies \p' — ^\ > 326:^). This follows again by Lemma \2M since 
p > 10/m^/^ implies — j^ 



+ 



So the overall probability that Algorithm [1] outputs REJECT is at least 5/6 — o(l) > 2/3. 



Proof, [of Lemma [33] Let Wf{V) = X^veV '^fiv)- Assuming that all elements in V are distinct, 
Vfiy) = Wf{V). For the first item of the lemma, it suffices to prove that if \\Vf — f/||oo < e/Am 
then 

and for the second item of the lemma, it suffices to prove that if \\Vf — U\\i > e then 

3e2 



Pr 



Wf{V) >il + ^)- 
16 m 



> 1-0(1). 



Note that the standard concentration inequalities cannot be used for proving the last inequality 
directly, because the probabilities of certain elements under Vf can be very high. To overcome this 
problem, we define P/(y) = mm{3 /m,Vf{y)} and Wf{V) = Y^y^v^fiv)- Clearly iy/(y) < Wf{V) 



for any V ^ hence proving Pr 
out to be easier: 



Wf{V) >(1 + 



3e^ 



t 



16 ' m. 



> 1 — 0(1) is sufficient. Surprisingly, this turns 
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Lemma 3.4 The following three statements hold 



1. if \\Vf - C/||oo < e/Am, then ^ < E[Wf{V)] < ll + f-\ ± 



2. if \\Vf - [/111 > e, then E\Wf{V)\ > 1 + ^ ±; 



3. Pr 



Wf{y)-E\Wf{y)\ 



> 



32m 



0(1). 



Assuming Lemma 13.41 (it is proved in Section [3. l.ip we have: 

• if IIP/ - C/ 1 loo < e/4m then clearly Wf{V) = Wf{V), therefore 



Pr 



l^/(^)--|> 



t . 3eH 



m 32171 



< Pr 



Wf{V)-E[Wf{V)] 



> 



32m 



0(1); 



if \\Vf - U\\i > e then 



Pr 



3e^ t 



WfiV)<{l + —) 
■' 16 m 



<Pr 



Wf{V)<{l + 



16 m 



<Pr 
Hence Lemma 



Wf{V)-E[Wf{V)] 
follows. 



> 



eh 
16rn- 



< Pr 



Wf{V)-K[Wf{V)] 



> 



eH 
32m 



0(1). 



3.1.1 Proof of Lemma 13.41 

We start by computing the expected value of Wf{V). 



E[Wf{V)] = Y.I1 ^/(^)^/(^) = M E ^/(")' + E 3P/(.)/m 



J/SV 2e[m] 



yZ:Vf{z)<3/m 



z:'Pf{z)>3/m 



M E^/(^)'- E Vf{z){Vfiz)-3/m)\. 

z:Vf{z)>3/m 



vz0m\ 



Let 5{z) = Vf{z) - l/m and let r = |{2 | 5{z) < 2/m}\. Then 

nwfiv)] = M E (V"^ + siz)f - Yl (V"^ + ^i^Hz) - 2/ 

\2e[m] z:5{z)>2/m 

and since Ylze\m\ ^(^) = we have 

= t{l/m+ ^ 5{zf + 2{m-r)/m'^ + ^ 5{z)/m 

\ z:5{z)<2/m z:5(z)>2/m 



m) 
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For the first item of the lemma, since 5{z) < e/Ara we have r = m, and hence the equality 
Wf{V) = Wf(y) always holds as there are no z for which 6{z) > 2/m. Therefore, from the above 
equation we have 

t 
m 



E[VF/(F)] = t I 1/m + ^ 5{zf I > 

z:5(z)<2/m 



and 



\ z:&{z)<2/m j \ z:5(z)<2/m / ^ ^ 



m 



Now we move to the second item of the lemma, where \\Vf — U\\i > e. By Cauchy-Schwarz we 



z:5{z)<2/m 



z:5{z)<2/m 



z:5{z)<2/m 



hence 



\ z:&{z)<2/m z:5{z)>2/m j 



>-'! + ( E i'^(^)i) + E ^(^) 

z:&{z)<2lm z:5{z)>2/m 

Since Ylize\m\ l^(-^)l = W^f ~ ^lli — ^' ^^ least one of 

E 1^(^)1 > ^/2 

2:5(2)<2/m 



or 



E 1^(^)1= E ^(^)>e/2 

z:S{z)>2/m z:5(z)>2/m 

must hold. In both cases we have E[Wj(y)] > ^(1 + ^), as required. 

Finally, we prove the third statement of the lemma. By Hoeffding's Inequality we have 



Pr 



¥.[Wf{V)] - Wf{V) > 



32m 



< exp 



2eH 



4+2 



l^2Am^Y.y^y{hy-ay) 



where hy and ay are upper and lower bounds on V{y). Since by < 3/m and Oj^ > for all y € [m] 
we get 



Pr 



nwf{v)] - Wf{v) > 



eh- 
32m 



< exp{-n{eH)) = o(l). 
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3.2 Testing Closeness to a Known Distribution 

In this section we prove Theorem 11.11 based on Theorem 13.11 Let Vf be an unknown distribution 
and let Vg be a known distribution, defined hy f,g : [n] — )■ [m] respectively. We show that for any 
e > 0, Algorithm [2] makes O ( ""'"'' '°'^'^T'°'^^°^"' ) queries and distinguishes the case \\Vf-Vg\\i = 
from the case \\Vf — Vg\\i > 5e with probability at least 2/3, satisfying the requirements of Theorem 



Algorithm 2 (Tests closeness to a known distribution.) 



1 
2 
3 
4 

5 
6 

7: 

8: 

9 

10 

11 

12 



let M^{Mo,..., Mk} ^ BucketiVg, [m], |) for k = ij^f^ 
for z = 1 to A; do 

if VgiMi) > e/k then 

if 1 1 ("P/) I Mi — ^|AfJ|i ^ £ (check using the amplified version of Algorithm [1] from Corollary 
[32]) then 

REJECT 
end if 
end if 
end for 
if ||('P/)(x) ~ {'Pg){M)\\i > £/4 (check classically with 0{\'k) = O(logm) queries [7j) then 

REJECT 
end if 
ACCEPT 



Observe that no queries are made by Algorithm [2] itself, and the total number of queries made 
by calls to Algorithm [His bounded by fc • 0(| • !Iil^!i^Ml!l) + QiVk) = 0(!Zil^!i2i!^Ll2gk^)|5| j^ 
addition, the failure probability of Algorithm [1] is at most 1/log m <^ 1/A;, so we can assume that 
with high probability none of its executions failed. 

For any i £ [k] and any x £ Mi, hy the definition of the buckets ^"log m - '^gi^) ^ miogm ■ 
Thus, for any i G [k] and x £ Mi, (1 - |)/|Mi| < 1/(1 + |)|Mi| < iVg)iM,ix) < (1 + f)/|Mi|, or 
equivalently for any i £ [k] we have ||('Pg)|Af,; — C^|AfJ|oo < mm \ ■ This means that if ||7^j — "Pglli =0 
then 

1. for any i £ [k], \\{'Pf)\Mi ~ U\Mi\\oo < J\M~\ ^^^ thus the tester never outputs REJECT in 
Line [5] (since we assumed that Algorithm [1] did not err in any of its executions). 

2. \\(T'f)(M) ~ i'P9){M)\\i = 0) ^^d hence the tester does not output REJECT in Line [TOl either. 

On the other hand, if \\Vf —Vg\\i > 5e then by Corollary 12.41 we know that either |('P/)(x) ~ 
{'Pg){M)\ > ^/4 ^^ there is at least one i £ [k] for which Vf{Mi) > e/k and ||('P/)|a/- — ('Pg)|AfJ|i > 
5e/4 (otherwise ||Pj — "P^Hi must be smaller than 2(5e/4 + e/4 + e) = 5e). In the first case the tester 
will reject in Line[TUl In the second case the tester will reject in Line[S]as ||('P/)|Mi ~ (Pg)|AfJli > 

*We use 5e instead e for better readability in the sequel. 

^The additional factor of | is for executing Algorithni[T]on the conditional distributions {Pf)\Mi ■, with Vj^Mi) > ^. 
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5e/4 implies (by the triangle inequality) ||(7^/)|Af, - U^mMi > e, since ||(7^(,)|Af, - f^|A/J|i < e/4 by 
Lemma 12.21 

4 Quantum Lower Bounds for Testing Distributions 

Here we show that our quantum testing algorithm for the known-unknown case is close to optimal: 
even for testing an unknown distribution (given as / : [n] — )• [m]) against the uniform one, we need 
j^/jyji/3\ quantum queries. As Bravyi, Hassidim, and Harrow |11] also independently observed, 
such a lower bound can be derived from known lower bounds for the collision problem. However, 
one has to be careful to use the version of the lower bound that applies to functions / : [m] — >• [m], 
due to Ambainis [3] and Kutin [27], rather than the earlier lower bound of Aaronson and Shi [^ 
that had to assume a larger range-size. 

Theorem 4.1 Let A be a quantum algorithm that given a fixed e G [0, 1] tests whether an unknown 
distribution is equal to uniform or at least e-far from it, meaning that for every / : [n] — )■ [m], with 
success probability at least 2/3, it decides whether Vf = U or \\Vf — f^||i > e (under the promise 
that one of these two cases holds). Then A makes Q,(m^'^] queries to f. 



Proof. Consider the following distribution on / : [m] — t- [m]: with probability 1/2, / is a random 
1-1 function (equivalently, a random permutation on [m]), and with probability 1/2, / is a random 
2-to-l function. In the first case we have Vf = U, while in the second case Vf{j) £ {0, 2/m} for all 
j G [m] and hence \\Vf — U\\i = 1. Thus a quantum testing algorithm like A can decide between 
these two cases with high success probability. But Ambainis [3] and Kutin [27] showed that this 
requires J7(?7i^''^) queries. ■ 

5 Quantum Lower Bounds for Reconstructing Distributions 

Previously we studied the problem of deciding whether an unknown distribution, given by / : [n] — ?■ 
[m], is close to or far from another distribution (which itself may be known or unknown). Of course, 
the easiest way to solve such a decision problem would be to reconstruct the unknown distribution, 
up to some small Li-error. Efficiently solving the reconstruction problem, say in m^'"^ or even m^'^ 
queries, would immediately allow us to solve the decision problem. However, below we prove that 
even quantum algorithms cannot solve the reconstruction problem efficiently. 

Theorem 5.1 Let < e < 1/2 be a fixed constant. Let A be a quantum algorithm that solves 
the reconstruction problem, meaning that for every / : [n] — )• [m], with probability at least 2/3, it 
outputs a probability distribution V G [0, 1]"* such that \\V — Vf\\i < e. Then A makes Vt{m/\ogm) 
queries to f . 

Proof. The proof uses some basic quantum information theory, and is most easily stated in a 
communication setting. Suppose Alice has a uniformly distributed m-bit string x of weight m/2. 
This is a random variable with entropy log (^2) = 1^ ~ 0{logm) bits. Let q be the number of 
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queries A makes. We will show below that Alice can give Bob Q{m) bits of information (about x), 
by a process that (interactively) communicates 0{qlogm) qubits. By Holevo's Theorem |25J (see 
also [161 Theorem 2] ) , establishing k bits of mutual information requires communicating at least k 
qubits, hence q = Q{m/logm). 

Given an x € {0, 1}™ of weight n = m/2, let / : [n] — t- [m] be an injective function to 
{j I Xj = 1}, and let Vf be the corresponding probability distribution over m elements (which 
is Vfij) = 2/m where Xj = 1, and Vf{j) = where Xj = 0). Let V be the distribution output 
by algorithm ^ on /. We have H'P — "P/Hi < e with probability at least 2/3. Define a string 
X G {0, 1}™ by Xj = 1 iff V{j) > 1/m. Note that at each position j G [m] where Xj ^ Xj, we 
have l'P(j) —'PfU)\ ^ ^/m. Hence ||7^ — P/||i > d{x,x)/m. Since \\V — VfWi < e (with probability 
at least 2/3), the algorithm's output allows us to produce (with probability at least 2/3) a string 
X G {0, 1}™ at Hamming distance d{x, x) < em from x. But then it is easy to calculate that the 
mutual information between x and x is Q(m) bits. 

Finally, to put this in the communication setting, note that Bob can run the algorithm A, 
implementing each query to / by sending the 0(logn)-qubit query-register to Alice, who plugs 
in the right answer and sends it back (this idea comes from |T2]). The overall communication is 
0{qlogTn) qubits. ■ 

6 From Sampling Problems to Oracle Problems 

A standard way to access a probability distribution V on [m] is by sampling it: sampling once gives 
the outcome y G [m] with probability V{y). However, in this paper we usually assume that we 
can access the distribution by querying a function / : [n] — )• [m] , where the probability of y is now 
interpreted as the fraction of the domain that is mapped to y. Below we describe the connection 
between these two approaches. 

Suppose we sample V n times, and estimate each probability Viy) by the fraction V{y) of times 
y occurs among the n outcomes. We will analyze how good an estimator this is for V{y). For all 
j G [n], let Yj be the indicator random variable that is 1 if the jth sample is y, and otherwise. 
This has expectation E[l^] = V{y) and variance Var[Yj] = V{y){\ — V{y)). Our estimator is V{y) = 
^■gr„il^/n. This has expectation E[P(y)] = V{y) and variance Var['P(y)] = V{y){l — V{y))/n, 
since the Y^'s are independent. Now we can bound the expected error of our estimator for V{y) by 



E 



\V{y) - V{y)\\ < ^E[\V{y)-V{yr] = ^Var [v{y)] < ^/vW^- 



And we can bound the expected Li-distance between the original distribution V and its approxi- 
mation V by 



E 



\V-V\\i 



Y, E [\r{y) - r{y)\\ < Y, Vny)h < TW^, 



where the last inequality used Cauchy-Schwarz and the fact that ^„'P(y) = 1. For instance, if 
n = 10000m then E[||P-P||i] < 1/100, and hence (by Markov's Inequality) \\V -V\\i < 1/10 
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with probability at least 9/10. If we now define a function / : [n] — )■ [m] by setting f{j) to the 
jth value in the sample, we have obtained a representation which is a good approximation of the 
original distribution. Note that if n = o{m) then we cannot hope to be able to approximately 
represent all possible m-element distributions by some / : [n] — )• [m], since all probabilities will be 
integer multiples of 1/n. For instance if V is uniform and n = o{m), then the total -Li-distance 
between V and a V induced by any / : [n] — )• [m] is near-maximal. Accordingly, the typical case 
we are interested in is n = G(m). 

7 Proof of Theorem 11.31 

In |19j . the bottleneck (with respect to the query complexity) of the algorithm for testing graph 
isomorphism in the known-unknown case is the subroutine that tests closeness between two distri- 
butions over V. All other parts of the algorithm make only a poly logarithmic number of queries. 
Therefore, our main theorem implies that with quantum oracle access, graph isomorphism in the 
known-unknown setting can be tested with 0(|y|^'^) queries. 

On the other hand, a general lower bound on the query complexity of testing distributions in 
the known-unknown case need not imply a lower bound for testing graph isomorphism. But still, 
in [19] it is proved that a lower bound on the query complexity for deciding whether the function 
/ : [n] — )• [n] is one-to-one (i.e., injective) or is two-to-one (i.e., the pre-image of any j G [n] is 
either empty or of size 2) is sufficient for showing a matching lower bound for graph isomorphism. 
Since our quantum lower bound for the known-unknown testing case is derived from exactly that 
problem (see Section H]), we get a matching lower bound of 0(|y|^''^) on the number of quantum 
queries necessary for testing graph isomorphism in the known-unknown case. 

For the unknown-unknown case, the lower bound mentioned in Theorem 11.31 follows from the 
lower bound for the known-unknown case. To get the upper bound of 0(|y|'^'^) queries, we have 
to slightly modify the algorithm from ^9\. We start by outlining the ideas in the algorithm of |19] 
for testing isomorphism between two unknown graphs G and H. 

Let G be a graph and Cq C V{G). A Cc-label of a vertex v G V{G) is a binary vector of length 
\Cg\ that represents the neighbors of v in Cq- The distribution Vcq over {0,1}' ''I is defined 
according to the graph G, where for every x G {0, Ijl'^cl ^j^e probability Vcci^) is proportional to 
the number of vertices in G with Cc-label equal to x. Notice that the support of Vcg i^ bounded 
hy\V{G)\. 

The algorithm of [19J is based on two main observations: 

1. if there is an isomorphism a between G and H, then for every Go ^ ^(G) and the corre- 
sponding Gh = (^{Gg), the distributions Vcg ^^^ '^Ch ^^^ identical. 

2. if G and H are far from being isomorphic, then for every equally-sized (and not too small) 
Cg ^ ^{G) and Gh ^ ^(H), either the distributions Vcg ^^^ '^Ch ^^^ f^^' ^^ otherwise 
it is possible to test with only a poly-logarithmic number of queries that there exists no 
isomorphism that maps Gg to Gh- 
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Once these observations are made, the high level idea in the algorithm of [19] is to go over a sequence 
of pairs of sets Cc Ch (such that with high probability at least one of them satisfies Ch = o'(C'g) 
if indeed an isomorphism a exists), and to test closeness between the corresponding distributions 
Vcg and Vc„ ■ 

This sequence of pairs is defined as follows: first we pick (at random) a set Ug of l^p ^ log \V\ 
vertices from G and a set Uh of l^p'^log \V\ vertices from H. Then we make all |y|^'^log \V\ 
possible queries in Ug x ^(C). After this, for any Cg Q Ug the distribution Vgq is known exactly. 
Indeed, the sequence of sets Cg,Ch will consist of all pairs Cg ^ Ug,Ch ^ Uh, where both Cg 
and Ch are of size log \V\. It is not hard to prove that if C and H have an isomorphism a, then 
with probability 1 — o(l) the size of Uh H (j{Ug) will exceed log^ \V\, and hence one of the pairs 
will satisfy Ch = o-(C'g)- 

Now, for each pair Cg,Ch we test if the distributions Vcq and Vc^ are identical. Since we 
know the distributions Vcq (for every Cg ^ Ug), we only need to sample the distributions Vch- 
Samphng the distributions Vch is done by taking a set 5 C V{H) of size 0(\/|^|) and re-using it 
for ah these tests. In total, the algorithm in [19j makes roughly \Ug x V{G)\ + \Uh x S\ = 0{\V\^/^) 
queries. 

To get the desired improvement, we follow the same path, but use our quantum distribution 
tester instead of the classical one. This allows us to reduce the size of the set S to 0(|y|^'^). 
Consequently, in order to balance the amount of queries we make in both graphs, we will resize the 
sets Ug and Uh to 0(|Fp^) and 0(|yp^) respectively, which still satisfies the "large-intersection" 
property and brings the total number of queries down to \Ug x F(G)| -|- \Uh x S*! = 0(11/1"^/^). 

8 Proof of Theorem 11.41 

8.1 Quantum Upper Bound 

The quantum tester is very simple, and completely based on existing ideas. First, run a variant of 
Shor's algorithm to find the period of / (if there is one), using 0(1) queries. Second, test whether 
the purported period is indeed the period, using another 0(1) queries as described above. Accept 
iff the latter test accepts. 

For the sake of completeness we sketch here how Shor's algorithm can be used to find the 
unknown period p of an / that is promised to be 1-1-p-periodic for some value oi p < -v/ra/2. Here 
is the algorithmo 

1. First prepare the 2-register quantum state —i= y^ |^)|0) 



2. Query / once (in superposition), giving —= > K)l/(*)) 

V ■" ■ r , 



®For this to work, the 1-1 property on [p] is crucial; for instance, quantum algorithms need about ^/n queries to 
find the period of functions with range {0, 1}. Also the fact that p = 0{^/n) is important, because the quantum 
algorithm needs to see many repetitions of the period on the domain [n]. 
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3. Measure the second register, which gives some f{s) for s G [p] and collapses the first register 
to the i having the same /-value: —^^=^ V^ l^)l/(^)) 

V L / yj i£[n],i=s mod p 

4. Do a quantum Fourier transfornu on the first register and measure. 



Some analysis shows that with high probability the measurement gives an i such that 



I c 
n p 



< 



— , where c is a random (essentially uniform) integer in \p] . Using continued fraction expan- 
sion, we can then calculate the unknown fraction c/p from the known fraction i/nO 

5. Doing the above 4 steps k times gives fractions ci/p, . . . , c^/p, each given as a numerator and a 
denominator (in lowest terms). Each of the k denominators divides p, and if A; is a sufficiently 
large constant then with high probability (over the Cj's), their least common multiple is p. 

8.2 Classical Lower Bound 

We saw above that quantum computers can efficiently test 1-1-periodicity Vn^^u^n^i^- Here we 
will show that this is not the case for classical testers: those need roughly \/r queries for 1-1- 
periodicity testing Vri2,ri ill particular roughly n^'^ queries for r = ^Jnll. Our proof follows along 
the lines of Lachish and Newman [28]. However, since their proof applies to functions with range 
0/1 that need not satisfy the 1-1 property, some modifications are needed. 

Fix a sufficiently large even integer r < n/2. We will use Yao's principle, proving a lower bound 
for deterministic query testers with error probability < 1/3 in distinguishing two distributions, one 
on negative instances and one on positive instances. First, the "negative" distribution 2?jv is uniform 
on all / : [n] — )• \m\ that are e-far from 'Pr/2,r- Second, the "positive" distribution Pp chooses a 
prime period p G [r/2, r] uniformly, then chooses a 1-1 function \p\ — )• \m\ uniformly ( equivalent ly, 
chooses a sequence oip distinct elements from [?ra]), and then completes / by repeating this period 
until the domain [n] is "full". Note that the last period will not be completed if p /n. 

Suppose q = o(Y^r/logr logn) is the number of queries of our deterministic tester. Fix a set Q = 
{zi, . . . ,Zg} C [n] of q queries. Let /(Q) ^ \f^^ denote the concatenated answers /(ii), . . . , /(ig). 
We prove two lemmas, one for the negative and one for the positive distribution, showing /(Q) to 
be close to uniformly distributed in both cases. 

Lemma 8.1 For all r] G [m]'^, we have Prx)^[/(Q) = 77] = (1 it o{l))m~'^. 

Proof. We first upper bound the number of functions / : [n] — )• [m] that are e- close to p-periodic 
for a specific p. The number of functions that are perfectly p-periodic is m^, since such a function 



^This is the unitary map |a;) — >■ -j= X]„g[„i e'^^''^^'"\y). If n is a power of 2 (which we can assume here without 
loss of generahty), then the QFT can be implemented using 0((logn)^) elementary quantum gates [29l Section 5.1]. 

®Two distinct fractions each with denominator < v'n/2 are at least 4/n apart. Hence there is only one fraction 
with denominator at most ^/n/2 within distance 2/n from the known fraction i/n. This unique fraction can only be 
c/p, and CFE efficiently finds it for us. Note that we do not obtain c and p separately, but just their ratio given as 
a numerator and a denominator in lowest terms. If c and p were coprime that would be enough, but that need not 
happen with high probability. 
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is determined by its first p values. The number of functions e-close to a fixed / is at most i^i)^^- 
Hence the number of functions e-close to Vp is at most mP (^^^m'^^ . Therefore, under the uniform 
distribution U on all mT' functions / : [n] — )■ [tti], the probability that there is a period p < r for 
which / is e-close to Vp is at most 



^ " "^ [en)''^ ^ n/2+H{e)n/ \ogm+en-n 



<m" 



m" 



where we used r < n/2, n < m, and (J^) < 2^'"^-'"' with H{-) denoting binary entropy. If e is a 
sufficiently small constant, then this probability is o{m~'^) (in fact much smaller than that). Hence 
the variation distance between Djy ^-nd the uniform distribution U is o{m~'^), and we have 



Pr[/(Q)=r,] 



Pr[/(Q)=^]-Pr[/(Q)=r?] 



Lemma 8.2 There exists an event B such that Vxx>p[B] = o{l), and for all rj € [m]'^ with distinct 
coordinates, we have Frj)p[f{Q) = r] \ B] = (1 ziz o{l))m^'^ . 

Proof. The distribution Dp uniformly chooses a prime period p £ [r/2, r]. By the prime number 
theorem (assuming r is at least a sufficiently large constant, which we may do because the lower 
bound is trivial for constant r), the number of distinct primes in this interval is asymptotically 

r r/2 r 



ln(r) ln(r/2) 21ogr 

Let B be the event that a p is chosen for which there exist distinct i,j G Q satisfying i = j mod 
p (equivalently, p divides i — j). For each fixed i,j there are at most logn primes dividing i — j- 
Hence at most (2) logn = o(r/ log r) p^s out of the at least r/2 log r possible p's can cause event B, 
implying FTj)p[B] = o(l). 

Conditioned on B not happening, f{Q) is a uniformly random element of [m]'^ with distinct 
coordinates, hence for each rj £ [m]'^ with distinct coordinates we have 

Pr[/(Q) = 7j\B] = -^ ^-— = m-" J] f 1 + ^-) = (1 + o(l))m-^. 

Vp mm — 1 m — q + 1 ^j^ \ m — i J 

■ 
Since (1 — o(l))m'^ of all 77 G [m]'^ have distinct coordinates, their weight under Dp sums 
to 1 — 0(1), and the other possible rj comprise only a o(l)-fraction of the overall weight. The 
query-answers f{Q) are the only access the algorithm has to the input. Hence the previous two 
lemmas imply that an algorithm with o(^\Jr j log r log n) queries cannot distinguish Dp and D^ 
with probability better than 1/2 -|- o(l). This establishes the claimed classical lower bound. 
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9 Suminary and Open Problems 

In this paper we studied and compared the quantum and classical query complexities of a number 
of testing problems. The first problem is deciding whether two probability distributions on a 
set [m] are equal or e-far. Our main result is a quantum tester for the case where one of the 
two distributions is known (i.e., given explicitly) while the other is unknown and represented by 
a function that can be queried. Our tester uses roughly m^'^ queries to the function, which is 
essentially optimal. It would be very interesting to extend this quantum upper bound to the case 
where both distributions are unknown. Such a quantum tester would show that the known-unknown 
and unknown-unknown cases have the same complexity in the quantum world. In contrast, they 
are known to have different complexities in the classical world: about m^''^ queries for the known- 
unknown case and about m"^'^ queries for the unknown-unknown case. The classical counterparts 
of these tasks play an important role in many problems related to property testing. We already 
mentioned one example, the graph isomorphism problem, where distribution testers are used as a 
black-box. We hope that the quantum analogues developed here and in [11] will find similar use. 

The second testing problem is deciding whether a given function / : [n] — t- [m] is periodic 
or far from periodic. For the specific version of the problem that we considered (where in the 
first case the period is at most about y/n, and the function is injective within each period), we 
proved that quantum testers need only a constant number of queries (using Shor's algorithm), 
while classical algorithms need about n^'^ queries. Both this result and Aaronson's recent result 
on "Fourier checking" [1] contrast with the constant- vs-log n and log n-vs-^/n separations obtained 
by Buhrman et al. |13) for other testing problems, but still leave open their question: is there a 
testing problem where the separation is "maximal", in the sense that quantum testers need only 
0(1) queries while classical testers need Q{n)? 
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